Repository navigation
audio: up_down_mixer: validate host output channel map - #11392
Open
Shrusti-pk wants to merge 1 commit into
Open
Shrusti-pk wants to merge 1 commit into
Shrusti-pk wants to merge 1 commit into
Conversation
up_down_mixer_init() takes the channel_map word of the IPC4 init payload as is when coefficients_select is one of the *_WITH_CHANNEL_MAP values. The 5.1 and 7.1 output routines then place each output channel at get_channel_location(map, channel) * 4 bytes into the frame and write there for every frame without any further check. A channel the map does not name resolves to CHANNEL_INVALID (0xF) and a channel placed in nibble 6 or 7 of a 5.1 map resolves to a slot past the six channel frame, so the last frame is written past the end of the sink buffer. Add out_channel_map_valid() and call it from init_mix(). A 5.1 map must place left, center, right, LFE and either the surround pair or, when both surround channels are absent, the side pair at slots below 6. A 7.1 map must name all eight channels. Mono and stereo output routines do not use the output map. The default maps built by create_channel_map() pass unchanged. Give the two mono to 5.1 routines the same side channel fallback the other 5.1 routines already have, and look the side channels up in the output map in upmix32bit_quatro_to_5_1() instead of the input map, so that the rule checked at init matches what every 5.1 routine writes. Signed-off-by: Shrushti P K <shrusthi@labs.digiscrypt.com>
Collaborator
|
Can one of the admins verify this patch?
|
PR 11392: test resultsRun date: 2026-11-03 07:43 UTC Tested commit: 9cb761d7f9800d4299dd3fd57981b6848d1af597
|
lgirdwood
reviewed
Nov 3, 2026
Comment on lines
+23
to
+31
| uint8_t left_surround_slot = get_channel_location(out_channel_map, CHANNEL_LEFT_SURROUND); | ||
| uint8_t right_surround_slot = get_channel_location(out_channel_map, CHANNEL_RIGHT_SURROUND); | ||
|
|
||
| /* Must support also 5.1 Surround */ | ||
| if (left_surround_slot == CHANNEL_INVALID && right_surround_slot == CHANNEL_INVALID) { | ||
| left_surround_slot = get_channel_location(out_channel_map, CHANNEL_LEFT_SIDE); | ||
| right_surround_slot = get_channel_location(out_channel_map, CHANNEL_RIGHT_SIDE); | ||
| } | ||
|
|
Member
There was a problem hiding this comment.
Need to be careful in the processing functions as these need to be fast. We should always do any validation in the module configuration APIs as these have time to validate. Pls try and moves the checks to non time critical functions.
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The HiFi3 memory-safety and surround-routing changes lack mixer regression tests and require target or equivalent runtime validation for malformed maps and 5.1/7.1 conversions.
No open issues 🎉
What changed in this PR
This PR hardens the up/down mixer against out-of-bounds writes caused by invalid host-supplied output channel maps, while preserving support for 5.1 layouts that use side channels.
Changes:
- Reject invalid 5.1 and 7.1 output channel maps during mixer initialization.
- Add side-channel fallback to both mono-to-5.1 routines and correct the quatro-to-5.1 fallback to use the output map.
| File | Description |
|---|---|
src/audio/up_down_mixer/up_down_mixer.c |
Validate output channel maps before initializing the mixer. |
src/audio/up_down_mixer/up_down_mixer_hifi3.c |
Align 5.1 side-channel handling with the new validation. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The up_down_mixer writes through a host supplied channel map without checking where it points:
Rejected such maps in init_mix(); the default maps from create_channel_map() and the 5.1 surround variant with the side pair still pass. The two mono to 5.1 routines gain the side pair fallback their siblings already have, and the quatro routine now reads the side pair from the output map, so the init check matches what every 5.1 routine writes.